Security analysts have discovered a new method that hackers are using for network scanning and tracking their victims - DNS tunneling. This technique allows them to evaluate their strategies, refine them, and confirm the delivery of malicious payloads to their victims.

Unit 42's report highlights two campaigns that use DNS tunneling. The first one, dubbed "SpamTracker," tracks the delivery of spam messages. The second campaign, codenamed "SecShow," uses DNS tunneling to scan network infrastructures.

In the SecShow campaign, the attackers embed IP addresses and timestamps into DNS queries to map out network layouts and discover potential configuration flaws that can be exploited for infiltration, data theft, or denial of service. The DNS queries used in this campaign were periodically repeated to enable real-time data gathering, detect status changes, and test the response of different network parts to unsolicited DNS requests.

Threat actors prefer DNS tunneling over more traditional methods like tracking pixels and regular network scanning tools for several reasons. These include the ability to bypass security tools, avoid detection, and maintain operational versatility.

Unit 42 proposes that organizations implement DNS monitoring and analysis tools to monitor and analyze logs for unusual traffic patterns and anomalies, such as atypical or high-volume requests. Additionally, it's advisable to limit the DNS resolvers in the network to handle only the necessary queries, reducing the potential of DNS tunneling misuse.